<?php

class mysql{
    //查询并统计相同ip的用户
    public function userIp()
    {
        $where = $this->request->getMore([
            [['ip', 's'], ''],
            [['page', 'd'], 1],
            [['limit', 'd'], 10],
            [['type', 'd'], 1],
            [['count', 'd'], 0]
        ]);

        if ($where['type'] == 1){
            $ip_name = 'add_ip';
        }else{
            $ip_name = 'last_ip';
        }

        $sql = 'select '.$ip_name.' as ip,GROUP_CONCAT(phone) as phones,count(uid) as count from eb_user';
        if (!empty($where['ip'])){
            $sql .=' WHERE '.$ip_name.' = \''.$where['ip'].'\'';
        }
        $sql.=' group by '.$ip_name;
        if (!empty($where['count'])){
            $sql.= ' having count>'.$where['count'];
        }
        $sql.=' ORDER BY count desc LIMIT '.($where['page']-1)*$where['limit'].','.$where['limit'].';';

        $data = Db::query($sql);

        foreach ($data as &$val){
            $val['phones'] = explode(',',$val['phones']);
        }
        return app('json')->success($data);
    }
}



        //此语句会导致sql注入
        字符串拼接mysql语句
        $list=$this->model->where("area_name like '%{$param['area_name']}%' and show_switch = 1")->whereOr("area_name='' and show_switch = 1")->order('weigh','desc')->select();
        示例 area_name为 ') AND (SELECT*FROM(SELECT(SLEEP(4)))znxe) limit 1#  
        会生成语句 
        SELECT * FROM `fa_platform_swiper` WHERE ( area_name like '%') AND (SELECT*FROM(SELECT(SLEEP(4)))znxe) limit 1#%' and show_switch = 1 ) ORDER BY `weigh` DESC
        会执行参数内的sql语句  

        应当改为
        $list = $this->model->where(['area_name' => ['like','%'.$param['area_name'].'%'],'show_switch' => 1])->order('weigh','desc')->select();
        使用参数绑定的形式